Besides the sheer size of the #codebase, Windows' fanatical #dedication to backwards #compatibility means there's a lot of really old code still in use. I suspect code written 20+ years ago is fairly likely to contain security problems that would never get written today.